@open-mercato/channel-apns 0.6.8-develop.6985.1.fb93574faa

package/src/modules/channel_apns/__integration__/TC-CHANNEL-PUSH-003.spec.ts

@@ -0,0 +1,67 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/helpers/integration/authFixtures'
+import { apiRequest } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+
+/**
+ * TC-CHANNEL-PUSH-003 — APNs is registered AND tenant-scoped.
+ *
+ * `@open-mercato/channel-apns` registers the `apns` push `ChannelAdapter` at import
+ * with `channelScope: 'tenant'`. Push providers have no OAuth/webhook surface of their
+ * own, so the credential-connect routes are where hub registration is observable:
+ *
+ * - the **per-user** route short-circuits tenant-scoped providers with 403
+ *   (`provider_is_tenant_scoped`) before touching credentials — 403 rather than 404
+ *   (`no_adapter`) proves the adapter is registered, and it guards against a non-admin
+ *   minting a tenant-wide channel;
+ * - the **tenant** route runs the adapter's own `validateCredentials`, which rejects the
+ *   empty payload with 422 — proving the adapter is not merely registered but reachable.
+ *
+ * Neither call creates a channel, so there is nothing to clean up. Real send paths are
+ * covered network-free by `lib/__tests__/adapter.test.ts`.
+ */
+test.describe('TC-CHANNEL-PUSH-003: APNs provider registration', () => {
+  test('POST per-user connect/credentials with providerKey=apns is refused (403, tenant-scoped)', async ({
+    request,
+  }) => {
+    const token = await getAuthToken(request)
+    const response = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/credentials',
+      {
+        token,
+        data: { providerKey: 'apns', displayName: 'APNs — per-user (should be refused)', credentials: {} },
+      },
+    )
+    expect(response.status(), 'route should not 5xx').toBeLessThan(500)
+    expect(response.status(), 'authenticated request should not 401').not.toBe(401)
+    expect(response.status()).toBe(403)
+    const body = await readJsonSafe<{ code?: string }>(response)
+    expect(body?.code).toBe('provider_is_tenant_scoped')
+  })
+
+  test('POST tenant connect/credentials with providerKey=apns reaches validateCredentials (422)', async ({
+    request,
+  }) => {
+    const token = await getAuthToken(request)
+    const response = await apiRequest(
+      request,
+      'POST',
+      '/api/communication_channels/channels/connect/tenant-credentials',
+      {
+        token,
+        // Missing p8Key/keyId/teamId/bundleId → validateCredentials rejects it, so the
+        // flow never creates a channel (no side effect / no cleanup needed).
+        data: { providerKey: 'apns', displayName: 'APNs — tenant connect', credentials: {} },
+      },
+    )
+    expect(response.status(), 'route should not 5xx').toBeLessThan(500)
+    // Asserting 422 (not merely "not 404") proves the request authenticated AND reached the
+    // adapter — a 401 auth misconfig would otherwise let the spec pass vacuously.
+    expect(response.status(), 'authenticated request should not 401').not.toBe(401)
+    expect(response.status(), 'registered adapter should reject empty credentials with 422').toBe(422)
+    const body = await readJsonSafe<{ error?: string; fieldErrors?: Record<string, string> }>(response)
+    expect(body?.fieldErrors ?? body?.error).toBeTruthy()
+  })
+})

package/src/modules/channel_apns/__integration__/TC-CHANNEL-PUSH-006.meta.ts

@@ -0,0 +1,3 @@
+export const integrationMeta = {
+  requiredEnvVars: ['OM_PUSH_FAKE_PROVIDERS'],
+}

package/src/modules/channel_apns/__integration__/TC-CHANNEL-PUSH-006.spec.ts

@@ -0,0 +1,145 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { createNotificationFixture } from '@open-mercato/core/helpers/integration/notificationsFixtures'
+import { drainIntegrationQueue } from '@open-mercato/core/helpers/integration/queue'
+import {
+  connectFakePushChannel,
+  deleteChannelIfExists,
+  deleteDeliveriesForDevice,
+  deleteFakePushDevice,
+  expectNativeMessage,
+  makeFakePushToken,
+  readLatestDelivery,
+  registerFakePushDevice,
+} from '@open-mercato/core/helpers/integration/pushFake'
+
+/**
+ * TC-CHANNEL-PUSH-006 — the REAL APNs adapter, end-to-end, without live credentials.
+ *
+ * Only the network provider is faked (`OM_PUSH_FAKE_PROVIDERS`): the adapter's credential resolution and
+ * `buildApnsNotification` run for real, against a real `apn.Notification`. The `.p8` key is never parsed
+ * because parsing lives inside the sender factory the fake replaces — the connect route only
+ * schema-validates it.
+ *
+ * The recorded message is therefore the WIRE form node-apn transmits: request `headers` (where
+ * `apns-push-type` lives) and the compiled `aps` payload.
+ */
+const PROVIDER = 'apns'
+
+type NativeApns = {
+  headers: Record<string, unknown>
+  payload: { aps: Record<string, unknown> } & Record<string, unknown>
+}
+
+test.describe('TC-CHANNEL-PUSH-006: real APNs adapter reaches sent with a correct native notification', () => {
+  test('maps pushOptions onto the aps payload for a visible notification', async ({ request }) => {
+    // Budgeted explicitly rather than via `test.slow()` (which only triples the config's 20s budget).
+    // NOTE: this does not fix the current CI failure — `POST /api/notifications` hangs >30s in the
+    // channel-package shard, so the test dies on `apiRequest`'s own 30s timeout. See the spec changelog.
+    test.setTimeout(120_000)
+    const adminToken = await getAuthToken(request, 'admin')
+    const { tenantId, userId } = getTokenScope(adminToken)
+    const { pushToken, tokenTail } = makeFakePushToken(PROVIDER)
+    const startedAt = new Date().toISOString()
+
+    let channelId: string | null = null
+    let userDeviceId: string | null = null
+    try {
+      channelId = await connectFakePushChannel(request, adminToken, PROVIDER, 'TC-CHANNEL-PUSH-006 APNs')
+      userDeviceId = await registerFakePushDevice(
+        request,
+        adminToken,
+        PROVIDER,
+        pushToken,
+        `qa-tc-channel-push-006-${Date.now()}`,
+      )
+
+      await createNotificationFixture(request, adminToken, {
+          recipientUserId: userId,
+          type: 'admin.custom_message',
+          title: 'Order shipped',
+          body: 'Your order is on its way',
+          pushOptions: { badge: 5, sound: 'chime.caf' },
+        })
+
+      await drainIntegrationQueue('events')
+      await drainIntegrationQueue('push-deliveries')
+
+      await expect
+        .poll(async () => (await readLatestDelivery(tenantId, userDeviceId as string))?.status ?? null, {
+          timeout: 30_000,
+        })
+        .toBe('sent')
+
+      const native = (await expectNativeMessage(PROVIDER, tokenTail, startedAt)) as unknown as NativeApns
+      expect(native.headers['apns-topic']).toBe('com.openmercato.fake')
+      expect(native.payload.aps).toMatchObject({
+        alert: { title: 'Order shipped', body: 'Your order is on its way' },
+        badge: 5,
+        sound: 'chime.caf',
+      })
+      expect(native.payload.aps['content-available']).toBeUndefined()
+    } finally {
+      await deleteDeliveriesForDevice(userDeviceId)
+      await deleteFakePushDevice(request, adminToken, userDeviceId)
+      await deleteChannelIfExists(request, adminToken, channelId)
+    }
+  })
+
+  test('a silent type produces a background content-available push with no user-facing copy', async ({ request }) => {
+    // Budgeted explicitly rather than via `test.slow()` (which only triples the config's 20s budget).
+    // NOTE: this does not fix the current CI failure — `POST /api/notifications` hangs >30s in the
+    // channel-package shard, so the test dies on `apiRequest`'s own 30s timeout. See the spec changelog.
+    test.setTimeout(120_000)
+    const adminToken = await getAuthToken(request, 'admin')
+    const { tenantId, userId } = getTokenScope(adminToken)
+    const { pushToken, tokenTail } = makeFakePushToken(PROVIDER)
+    const startedAt = new Date().toISOString()
+
+    let channelId: string | null = null
+    let userDeviceId: string | null = null
+    try {
+      channelId = await connectFakePushChannel(request, adminToken, PROVIDER, 'TC-CHANNEL-PUSH-006 APNs silent')
+      userDeviceId = await registerFakePushDevice(
+        request,
+        adminToken,
+        PROVIDER,
+        pushToken,
+        `qa-tc-channel-push-006-silent-${Date.now()}`,
+      )
+
+      // Silent-ness is a property of the registered type, never a per-call flag.
+      await createNotificationFixture(request, adminToken, {
+          recipientUserId: userId,
+          type: 'admin.custom_silent',
+          title: 'Should not be delivered as copy',
+          body: 'Should not be delivered as copy',
+          data: { sync: 'orders' },
+        })
+
+      await drainIntegrationQueue('events')
+      await drainIntegrationQueue('push-deliveries')
+
+      await expect
+        .poll(async () => (await readLatestDelivery(tenantId, userDeviceId as string))?.status ?? null, {
+          timeout: 30_000,
+        })
+        .toBe('sent')
+
+      const row = await readLatestDelivery(tenantId, userDeviceId as string)
+      expect(row?.silent).toBe(true)
+
+      const native = (await expectNativeMessage(PROVIDER, tokenTail, startedAt)) as unknown as NativeApns
+      // Apple requires both of these for a background push; sending an alert alongside them is invalid.
+      expect(native.headers['apns-push-type']).toBe('background')
+      expect(native.headers['apns-priority']).toBe(5)
+      expect(native.payload.aps).toEqual({ 'content-available': 1 })
+      expect(native.payload.sync).toBe('orders')
+    } finally {
+      await deleteDeliveriesForDevice(userDeviceId)
+      await deleteFakePushDevice(request, adminToken, userDeviceId)
+      await deleteChannelIfExists(request, adminToken, channelId)
+    }
+  })
+})

package/src/modules/channel_apns/acl.ts

@@ -0,0 +1,6 @@
+export const features = [
+  { id: 'channel_apns.view', title: 'View APNs channel configuration', module: 'channel_apns' },
+  { id: 'channel_apns.configure', title: 'Configure APNs credentials', module: 'channel_apns' },
+]
+
+export default features

package/src/modules/channel_apns/di.ts

@@ -0,0 +1,26 @@
+import { asValue } from 'awilix'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import {
+  hasChannelAdapter,
+  registerChannelAdapter,
+} from '@open-mercato/core/modules/communication_channels/lib/adapter-registry-singleton'
+import { getApnsChannelAdapter } from './lib/adapter'
+import { ensureApnsFakeProviderInstalled } from './lib/fake-provider'
+import { channelApnsHealthCheck } from './lib/health'
+
+export function register(container: AppContainer): void {
+  // Test-only: swap @parse/node-apn for a network-free fake when `OM_PUSH_FAKE_PROVIDERS` is set
+  // (no-op in production), so integration specs exercise this adapter end-to-end. Swaps the SDK
+  // client only — the adapter below stays registered. See lib/fake-provider.ts.
+  ensureApnsFakeProviderInstalled()
+
+  if (!hasChannelAdapter('apns')) {
+    registerChannelAdapter(getApnsChannelAdapter())
+  }
+  container.register({
+    channelApnsAdapter: asValue(getApnsChannelAdapter()),
+    // Registered under the exact service name declared in `integration.ts`
+    // (`healthCheck.service`); without it the hub's resolve throws.
+    channelApnsHealthCheck: asValue(channelApnsHealthCheck),
+  })
+}

package/src/modules/channel_apns/index.ts

@@ -0,0 +1,6 @@
+export const metadata = {
+  id: 'channel_apns',
+  title: 'Apple Push Notification Channel',
+  description:
+    'Deliver mobile push to iOS devices via the Apple Push Notification service (HTTP/2, token-based .p8 auth). Registers a `push` ChannelAdapter (providerKey `apns`) into the Communications Hub.',
+}

package/src/modules/channel_apns/integration.ts

@@ -0,0 +1,77 @@
+import {
+  type IntegrationBundle,
+  type IntegrationDefinition,
+} from '@open-mercato/shared/modules/integrations/types'
+
+export const integration: IntegrationDefinition = {
+  id: 'channel_apns',
+  title: 'Apple Push Notification service',
+  description:
+    'Deliver mobile push to iOS devices via APNs (HTTP/2, token-based .p8 auth). Provider for the push_notifications channel.',
+  category: 'communication',
+  hub: 'communication_channels',
+  providerKey: 'apns',
+  icon: 'apple',
+  docsUrl: 'https://developer.apple.com/documentation/usernotifications',
+  package: '@open-mercato/channel-apns',
+  version: '0.1.0',
+  author: 'Open Mercato Team',
+  company: 'Open Mercato',
+  license: 'MIT',
+  tags: ['push', 'apns', 'apple', 'ios', 'communication'],
+  apiVersions: [
+    {
+      id: 'v1',
+      label: 'APNs HTTP/2 (token auth)',
+      status: 'stable',
+      default: true,
+      changelog: 'Apple Push Notification service over HTTP/2 with token-based .p8 auth (@parse/node-apn).',
+    },
+  ],
+  credentials: {
+    fields: [
+      {
+        key: 'p8Key',
+        label: 'APNs Auth Key (.p8)',
+        type: 'secret',
+        required: true,
+        helpText:
+          'Apple Developer -> Keys -> create an APNs key, download the .p8, and paste its contents here. Stored encrypted at rest.',
+      },
+      {
+        key: 'keyId',
+        label: 'Key ID',
+        type: 'text',
+        required: true,
+        helpText: 'The 10-character identifier of the APNs key (from the key filename / Apple Developer portal).',
+      },
+      {
+        key: 'teamId',
+        label: 'Apple Team ID',
+        type: 'text',
+        required: true,
+        helpText: 'Your 10-character Apple Developer Team ID.',
+      },
+      {
+        key: 'bundleId',
+        label: 'App Bundle ID',
+        type: 'text',
+        required: true,
+        placeholder: 'com.example.app',
+        helpText: 'The app bundle id, used as the APNs topic.',
+      },
+      {
+        key: 'production',
+        label: 'Production (use production APNs host)',
+        type: 'boolean',
+        required: false,
+        helpText: 'Leave off for the sandbox host during development.',
+      },
+    ],
+  },
+  healthCheck: { service: 'channelApnsHealthCheck' },
+}
+
+export const integrations: IntegrationDefinition[] = [integration]
+export const bundles: IntegrationBundle[] = []
+export const bundle: IntegrationBundle | undefined = undefined

package/src/modules/channel_apns/lib/__tests__/adapter.test.ts

@@ -0,0 +1,158 @@
+import { buildApnsNotification, getApnsChannelAdapter, setApnsSenderFactory, type ApnsSender } from '../adapter'
+import type { SendMessageInput } from '@open-mercato/core/modules/communication_channels/lib/adapter'
+import type { PushEnvelope } from '@open-mercato/core/modules/communication_channels/lib/push-envelope'
+import { APNS_TEST_P8_KEY } from './apnsTestKey'
+
+const credentials = {
+  p8Key: APNS_TEST_P8_KEY,
+  keyId: 'ABC123KEYI',
+  teamId: 'TEAM123456',
+  bundleId: 'com.example.app',
+  production: false,
+}
+
+function buildInput(overrides?: Partial<SendMessageInput>): SendMessageInput {
+  return {
+    content: {
+      text: 'Body text',
+      bodyFormat: 'text',
+      raw: { title: 'Hello', body: 'Body text', data: { type: 'orders.shipped', notificationId: 'n1' } },
+    },
+    credentials,
+    scope: { tenantId: 't1', organizationId: 'o1' },
+    metadata: { pushToken: 'apns-device-token-abc', platform: 'ios' },
+    ...overrides,
+  }
+}
+
+afterEach(() => setApnsSenderFactory(null))
+
+describe('ApnsChannelAdapter', () => {
+  it('sends a notification with the bundle id as topic', async () => {
+    const send: ApnsSender = jest.fn(async () => ({ ok: true }))
+    setApnsSenderFactory(() => send)
+
+    const result = await getApnsChannelAdapter().sendMessage(buildInput())
+
+    expect(result.status).toBe('sent')
+    expect(send).toHaveBeenCalledTimes(1)
+    const [payload, token] = (send as jest.Mock).mock.calls[0]
+    expect(token).toBe('apns-device-token-abc')
+    expect(payload).toMatchObject({ title: 'Hello', body: 'Body text', topic: 'com.example.app' })
+    expect(payload.data).toEqual({ type: 'orders.shipped', notificationId: 'n1' })
+  })
+
+  it('forwards the silent flag and push options to the sender', async () => {
+    const send: ApnsSender = jest.fn(async () => ({ ok: true }))
+    setApnsSenderFactory(() => send)
+
+    await getApnsChannelAdapter().sendMessage(
+      buildInput({
+        content: {
+          raw: {
+            title: '',
+            body: '',
+            data: { type: 'sync.data.updated' },
+            silent: true,
+            options: { badge: 4, priority: 'normal' },
+          },
+        },
+      }),
+    )
+
+    const [payload] = (send as jest.Mock).mock.calls[0]
+    expect(payload.silent).toBe(true)
+    expect(payload.options).toEqual({ badge: 4, priority: 'normal' })
+    expect(payload.topic).toBe('com.example.app')
+  })
+
+  it('fails fast when the push token is missing', async () => {
+    const result = await getApnsChannelAdapter().sendMessage(buildInput({ metadata: { platform: 'ios' } }))
+    expect(result.status).toBe('failed')
+    expect(result.error).toBe('missing_push_token')
+  })
+
+  it('rejects invalid credentials without sending', async () => {
+    const send = jest.fn()
+    setApnsSenderFactory(() => send as unknown as ApnsSender)
+    const result = await getApnsChannelAdapter().sendMessage(buildInput({ credentials: { p8Key: 'x' } }))
+    expect(result.status).toBe('failed')
+    expect(result.error).toBe('invalid_apns_credentials')
+    expect(send).not.toHaveBeenCalled()
+  })
+
+  // Only 410/Unregistered is a permanent dead-token signal. `'410'` is included so a bare-status
+  // rejection (node-apn couldn't parse a reason from the body) still prunes the device.
+  it.each(['Unregistered', '410'])(
+    'maps the %s rejection to the device_unregistered sentinel',
+    async (reason) => {
+      setApnsSenderFactory(() => async () => ({ ok: false, reason }))
+      const result = await getApnsChannelAdapter().sendMessage(buildInput())
+      expect(result.status).toBe('failed')
+      expect(result.error).toBe('device_unregistered')
+      expect(result.metadata?.unregistered).toBe(true)
+    },
+  )
+
+  it('does NOT unregister on BadDeviceToken (valid token, wrong environment)', async () => {
+    // Apple returns BadDeviceToken for a valid token sent to the wrong environment, not only for a
+    // malformed one. Treating it as permanent would soft-delete every live device on an env-config
+    // mistake, so it must be a transient failure that KEEPS the device.
+    setApnsSenderFactory(() => async () => ({ ok: false, reason: 'BadDeviceToken' }))
+    const result = await getApnsChannelAdapter().sendMessage(buildInput())
+    expect(result.status).toBe('failed')
+    expect(result.error).toBe('BadDeviceToken')
+    expect(result.metadata?.unregistered).toBeUndefined()
+  })
+
+  it('treats other rejections as transient failures', async () => {
+    setApnsSenderFactory(() => async () => ({ ok: false, reason: 'TooManyRequests' }))
+    const result = await getApnsChannelAdapter().sendMessage(buildInput())
+    expect(result.status).toBe('failed')
+    expect(result.error).toBe('TooManyRequests')
+    expect(result.metadata?.unregistered).toBeUndefined()
+  })
+
+  it('reports transport errors as transient failures', async () => {
+    setApnsSenderFactory(() => async () => ({ ok: false, error: 'socket hang up' }))
+    const result = await getApnsChannelAdapter().sendMessage(buildInput())
+    expect(result.status).toBe('failed')
+    expect(result.error).toBe('socket hang up')
+    expect(result.metadata?.unregistered).toBeUndefined()
+  })
+})
+
+function envelope(overrides: Partial<PushEnvelope> = {}): PushEnvelope & { topic: string } {
+  return {
+    title: 'Hello',
+    body: 'Body text',
+    data: { type: 'orders.shipped' },
+    options: {},
+    silent: false,
+    topic: 'com.example.app',
+    ...overrides,
+  }
+}
+
+describe('buildApnsNotification', () => {
+  it('builds a content-available background note for a silent envelope', () => {
+    const note = buildApnsNotification({}, envelope({ title: '', body: '', silent: true }))
+    expect(note.contentAvailable).toBe(1)
+    expect(note.pushType).toBe('background')
+    expect(note.priority).toBe(5)
+    expect(note.alert).toBeUndefined()
+    expect(note.sound).toBeUndefined()
+    expect(note.payload).toEqual({ type: 'orders.shipped' })
+  })
+
+  it('applies alert, sound, badge, body override and priority from options', () => {
+    const note = buildApnsNotification(
+      {},
+      envelope({ options: { sound: 'chime.caf', badge: 7, priority: 'normal', body: 'override body' } }),
+    )
+    expect(note.alert).toEqual({ title: 'Hello', body: 'override body' })
+    expect(note.sound).toBe('chime.caf')
+    expect(note.badge).toBe(7)
+    expect(note.priority).toBe(5)
+  })
+})

package/src/modules/channel_apns/lib/__tests__/apnsTestKey.ts

@@ -0,0 +1,21 @@
+import { generateKeyPairSync } from 'node:crypto'
+
+/**
+ * A throwaway ES256 (P-256) private key in PKCS#8 PEM — the curve Apple's `.p8`
+ * signing keys use.
+ *
+ * `apnsCredentialsSchema` structurally parses `p8Key` with `createPrivateKey`,
+ * so fixtures need a genuinely parseable key. Generating one per test process
+ * keeps a private key out of the repository while still exercising the real
+ * validation path.
+ */
+export function generateApnsTestP8Key(): string {
+  return generateKeyPairSync('ec', {
+    namedCurve: 'P-256',
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+  }).privateKey
+}
+
+/** Shared instance so a suite's fixtures all agree on one key. */
+export const APNS_TEST_P8_KEY = generateApnsTestP8Key()

package/src/modules/channel_apns/lib/__tests__/credentials.test.ts

@@ -0,0 +1,98 @@
+import { apnsCredentialsSchema, resolveApnsCredentials } from '../credentials'
+import { APNS_TEST_P8_KEY } from './apnsTestKey'
+import {
+  PUSH_CREDENTIAL_ERROR_INVALID_BUNDLE_ID,
+  PUSH_CREDENTIAL_ERROR_INVALID_KEY_ID,
+  PUSH_CREDENTIAL_ERROR_INVALID_P8,
+  PUSH_CREDENTIAL_ERROR_INVALID_TEAM_ID,
+} from '@open-mercato/core/modules/communication_channels/lib/push-credential-errors'
+
+const validCredentials = {
+  p8Key: APNS_TEST_P8_KEY,
+  keyId: 'ABC123DEFG',
+  teamId: 'TEAM123456',
+  bundleId: 'com.demo.app',
+}
+
+function firstIssueMessage(input: unknown): string | undefined {
+  const parsed = apnsCredentialsSchema.safeParse(input)
+  return parsed.success ? undefined : parsed.error.issues[0]?.message
+}
+
+describe('apnsCredentialsSchema', () => {
+  it('accepts well-formed credentials', () => {
+    const parsed = apnsCredentialsSchema.safeParse({ ...validCredentials, production: true })
+    expect(parsed.success).toBe(true)
+  })
+
+  it('accepts credentials without the optional production flag', () => {
+    const parsed = apnsCredentialsSchema.safeParse(validCredentials)
+    expect(parsed.success).toBe(true)
+  })
+
+  it('rejects when a required field is missing', () => {
+    const { p8Key, ...withoutKey } = validCredentials
+    expect(apnsCredentialsSchema.safeParse(withoutKey).success).toBe(false)
+    expect(apnsCredentialsSchema.safeParse({ ...validCredentials, keyId: '' }).success).toBe(false)
+    expect(apnsCredentialsSchema.safeParse({ ...validCredentials, teamId: '' }).success).toBe(false)
+    expect(apnsCredentialsSchema.safeParse({ ...validCredentials, bundleId: '' }).success).toBe(false)
+  })
+
+  it('rejects malformed input', () => {
+    expect(apnsCredentialsSchema.safeParse({ p8Key: 123 }).success).toBe(false)
+    expect(apnsCredentialsSchema.safeParse('not-an-object').success).toBe(false)
+  })
+
+  // Regression: a non-empty but unparseable `.p8` used to pass validation, so the
+  // channel connected and showed as Active while being unable to deliver anything.
+  it('rejects a p8Key that is not a parseable private key', () => {
+    expect(
+      firstIssueMessage({ ...validCredentials, p8Key: 'obviously-not-a-key' }),
+    ).toBe(PUSH_CREDENTIAL_ERROR_INVALID_P8)
+    expect(
+      firstIssueMessage({
+        ...validCredentials,
+        p8Key: '-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----\n',
+      }),
+    ).toBe(PUSH_CREDENTIAL_ERROR_INVALID_P8)
+  })
+
+  it('rejects Apple identifiers that are not 10 alphanumeric characters', () => {
+    expect(firstIssueMessage({ ...validCredentials, keyId: 'SHORT' })).toBe(
+      PUSH_CREDENTIAL_ERROR_INVALID_KEY_ID,
+    )
+    expect(firstIssueMessage({ ...validCredentials, teamId: 'WAY-TOO-LONG-1' })).toBe(
+      PUSH_CREDENTIAL_ERROR_INVALID_TEAM_ID,
+    )
+  })
+
+  it('rejects a bundleId that is not reverse-DNS', () => {
+    expect(firstIssueMessage({ ...validCredentials, bundleId: 'notreversedns' })).toBe(
+      PUSH_CREDENTIAL_ERROR_INVALID_BUNDLE_ID,
+    )
+  })
+})
+
+describe('resolveApnsCredentials', () => {
+  it('passes through the strongly-typed send config', () => {
+    const resolved = resolveApnsCredentials({ ...validCredentials, production: true })
+    expect(resolved.p8Key).toBe(validCredentials.p8Key)
+    expect(resolved.keyId).toBe(validCredentials.keyId)
+    expect(resolved.teamId).toBe(validCredentials.teamId)
+    expect(resolved.bundleId).toBe(validCredentials.bundleId)
+  })
+
+  it('keeps boolean production flags verbatim', () => {
+    expect(resolveApnsCredentials({ ...validCredentials, production: true }).production).toBe(true)
+    expect(resolveApnsCredentials({ ...validCredentials, production: false }).production).toBe(false)
+  })
+
+  it('coerces string production flags via parseBooleanWithDefault', () => {
+    expect(resolveApnsCredentials({ ...validCredentials, production: 'true' }).production).toBe(true)
+    expect(resolveApnsCredentials({ ...validCredentials, production: 'false' }).production).toBe(false)
+  })
+
+  it('defaults production to false when omitted', () => {
+    expect(resolveApnsCredentials(validCredentials).production).toBe(false)
+  })
+})